Privacy Policy

1. Who is responsible

SocialNow, Amstelstraat 43G, 1017 DA Amsterdam, the Netherlands, Chamber of Commerce 90877179, is the controller for the data of visitors and account holders. For the data an account holder puts into their own workspace (their own customers, contacts, orders and team members) the account holder is the controller and SocialNow is the processor; section 12 applies to that.

Questions, requests and complaints about privacy: info@socialnow.nl. We respond within one month.

2. What we process

On the website we only process what you leave yourself:

• Name, e-mail address and phone number when you contact us through the form, e-mail or WhatsApp
• Name, e-mail address, country and (if you fill it in) phone number when you go to the demo through the welcome notice, so we can contact you about SocialNow later
• Company name and project information with a request or quote
• The content of your message

In SocialNow OS we additionally process:

• Your account: name, e-mail address, profile picture and how you sign in (Google, e-mail code, sign-in link or password); we never see your password itself
• Your workspace: company name, industry, website, branding (logo, colours, fonts, tone of voice) and everything you fill in yourself
• Team members: e-mail address, name and role of the people you invite
• What you create in the OS: pieces, texts, images, documents, campaigns and the chat conversations with Milo
• Payments: the credit bought and the payment status; card details go straight to Stripe and never reach us
• Usage data: which parts you use, what you ask the OS, error messages and how the tools perform for your workspace
• Technical data: IP address, browser and time, only for security, rate limiting and troubleshooting
• Your language choice and your agreement to the terms (version and time)

Data from sources you connect yourself, only for your own workspace:

• Odoo: customers, contacts, leads, orders, invoices and products, as your Odoo environment supplies them
• Meta (Facebook and Instagram): page and ad data, statistics and the posts you publish through the OS
• Google (Ads, Analytics, Business Profile): campaign statistics and account data
• The keys and tokens you enter for this are stored encrypted and never shown again

3. Purposes and legal bases

We use data only for these purposes, each with a legal basis under article 6 GDPR:

• Answering your question or request and preparing a quote: performance of (entering into) a contract
• Making the OS work for you: signing in, showing your workspace, creating content and documents, reading connected sources: performance of the contract
• Invoicing and processing payments: performance of the contract and legal obligation (tax retention duty)
• Security, preventing abuse and fixing errors: legitimate interest
• Optional usage measurement and separate masked session recordings for product improvement (section 4): consent
• Informing you about changes to the OS, the terms or this policy: performance of the contract
• Marketing to existing customers about similar services: legitimate interest, always with an opt-out

4. Usage measurement, recordings and support

Creating an account does not give us blanket permission to use your business content for our own product development. Necessary security and support rely on the agreement and our legitimate interest. Administrative access is limited to authorised people and is logged.

Optional usage measurement with PostHog in the EU starts only after consent. We collect a pseudonymous identifier, a workspace identifier, screen routes and predefined events. Email addresses, free-text searches, prompts, customer names and documents are excluded from this measurement. Pseudonymous data remains personal data.

Masked session recordings require a separate choice, off by default. Text, inputs and media are masked. Account, CRM, payment and administration screens are excluded; chat content is blocked. No audio, camera or full-device screen is recorded. New recordings are retained for 30 days. Ordinary usage events remain available for up to one year on our current PostHog plan, allowing seasonal comparisons.

You can withdraw either choice under Account without losing functionality. This stops new measurements and recordings. Withdrawal does not automatically erase existing data; request erasure at info@socialnow.nl. We do not sell this data, use it for third-party advertising or share it with other customers.

Using business content for an additional purpose of our own requires a separate assessment and legal basis. Acceptance of the terms does not replace this.

5. Who helps us (processors)

These parties process data on our behalf, under a data processing agreement or the provider's standard GDPR terms:

• Google Firebase (Google Ireland Ltd): signing in with Google, e-mail code or sign-in link; account data
• Vercel Inc.: hosting of the OS and the API, and storage of your workspace (Vercel Blob, EU region where possible)
• PostHog Inc.: optional usage measurement and separately permitted masked session recordings (EU data region)
• Hostinger: sending e-mail from info@socialnow.nl, such as sign-in codes, invitations and notifications
• Stripe Payments Europe Ltd: payments for credit; for card details Stripe is an independent controller
• GitHub Inc.: hosting of socialnow.nl (GitHub Pages)
• AI providers (section 6) for creating texts and images at your request

6. Artificial intelligence

The OS creates texts, images and analyses with language and image models. For that we send the data needed for your request (your story, your branding, the relevant figures) to a model provider. We currently use Google (Gemini, via Google Cloud Vertex AI or the Gemini API) and, depending on the chosen render option, Higgsfield or OpenAI for images.

These providers process the data only to produce the response. We choose contracts and settings under which your input is not used to train their models. Model output can contain errors; check what you publish.

Milo, the assistant in the OS, only sees the data of your own workspace and what you share in the conversation yourself.

7. Transfers outside the EU

Some providers are based in the United States or process data there (Vercel, GitHub, Stripe, Google, OpenAI). Transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses with additional measures. Where possible we choose storage and processing in the EU.

8. Retention

We keep data no longer than needed:

• Contact details of a request without an order: at most two years after the last contact
• Data from the demo sign-up: at most two years, or shorter if you ask us to erase it
• Account and workspace data: as long as your account exists; after deletion erased from active systems within thirty days and from backups within ninety days
• Data from connected sources: only while the connection exists; disconnecting erases the copied data and the key
• Chat conversations with Milo and created pieces: as long as your account exists, unless you delete them earlier
• Invoices and payment data: seven years (tax retention duty)
• Technical logs (IP address, error messages): at most thirty days
• Your agreement to the terms: as long as your account exists, plus the statutory limitation period

9. Cookies and local storage

Socialnow.nl sets no tracking cookies and uses no analytics. In your browser (localStorage) we only remember that you have seen the notice about the terms, and in cookies on socialnow.nl which language and country you chose and whether you allowed measurement in the OS.

SocialNow OS uses functional cookies and storage, and measures usage only if you allow it:

• __session: keeps note that you are signed in (55 minutes, or 30 days if you tick 'keep me signed in')
• sn-taal and sn-land: your language and country choice (one year)
• sn-meten and sn-replay-v1: separate choices for measurement and recording (180 days in the app); change them under Account
• Only with your consent: PostHog (EU) measures which parts you use, linked to a pseudonym and workspace identifier, to improve the OS. Without consent PostHog does not load
• Firebase storage in your browser for signing in and remembering your sign-in link address
• Local storage for preferences such as your chosen theme, and for drafts not yet saved

10. Security

We take appropriate technical and organisational measures:

• All connections run over https; the API only accepts requests from the app itself
• Keys and tokens of connected sources are stored encrypted and never shown again; only the server can use them
• Passwords are managed by Google Firebase and are not readable by us; sign-in codes work once and expire after fifteen minutes
• Every workspace is strictly separated; the code that accesses storage can only reach its own workspace
• Rate limiting on sign-in and API requests, and logging of admin actions
• Access by the SocialNow team is limited to what is needed and is logged
• In the event of a data breach that poses a risk we notify the Dutch Data Protection Authority within 72 hours and inform those affected

11. Your rights

Under the GDPR you have the right to:

• Access to your data and a copy of it
• Correction of inaccurate data
• Erasure ('right to be forgotten')
• Restriction of processing
• Transfer of your data in a common file format (data portability)
• Objection to processing based on legitimate interest, including necessary security and marketing
• Withdrawal of consent given, without affecting what was processed before

In the OS you see under Account which data we hold about you, you can change your name and language, disconnect your sources and delete your account with its workspaces. For everything else e-mail info@socialnow.nl; we may ask you to confirm your identity. You can also lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

12. When you are the controller: your customers in the OS

If you put data of your own customers, leads or team members into the OS, or connect your Odoo, Meta or Google, you are the controller for that data and SocialNow processes it on your behalf. Until 19 September 2026 this section held a summary that called itself a data processing agreement. Five bullet points are not an agreement within the meaning of Article 28(3) GDPR, which requires a fixed list of subjects that was not in it. There is now a full data processing agreement at socialnow.nl/verwerkersovereenkomst, covering the instruction binding, the sub-processors, the security measures, transfers, audit and what happens to your data at the end. That agreement applies, and this is what it comes down to:

• We process this data only to make the OS work for you and according to your instructions through the OS
• We only engage the processors in sections 5 and 6 and inform you on this page about changes; you can object by ending your account
• We take the measures in section 10, help you with data subject requests and with a data protection impact assessment, and report a data breach affecting your data without undue delay
• When your account ends we erase the data as in section 8, unless the law requires us to keep it
• You make sure you have a legal basis to give us this data and inform your own customers where needed

13. Children

SocialNow OS is meant for businesses. We do not target people under 16 and do not knowingly process their data. If we notice we did, we erase it.

14. Automated decision-making

The OS makes suggestions and drafts, but takes no decisions with legal or similarly significant effects for you without human involvement. Publishing, sending and paying only happen on your explicit action.

15. Changes

We may change this policy, for example for a new feature or provider. The current version is always at socialnow.nl/privacy with the date at the top. For a change that affects your rights we ask for your agreement again in the OS and inform account holders by e-mail.

16. Outside the EU: the United Kingdom, Switzerland and the United States

SocialNow is established in the Netherlands and works with clients and visitors from more countries. Where another regime applies, the following applies alongside the rest of this policy.

United Kingdom: if you are established in the UK, the UK GDPR and the Data Protection Act 2018 apply. Your rights are the same as above. A complaint goes to the Information Commissioner's Office (ico.org.uk). Transfers from the UK to us rest on the UK adequacy regulations for the EEA; if data subsequently leaves the EEA, the UK International Data Transfer Addendum to the standard contractual clauses applies.

Switzerland: if you are established in Switzerland, the Federal Act on Data Protection applies. Your rights are equivalent; your complaint goes to the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

United States, California: if you are a California resident, the CCPA as amended by the CPRA gives you a number of rights which we expressly confirm below.

• We do not sell personal information and do not share it for cross-context behavioural advertising. We never have and do not intend to; that is also why there is no 'Do Not Sell or Share' control on our site, because there is nothing to switch off
• Right to know which categories of personal information we collect, from where, for what and with whom we share it: that is in sections 2, 3 and 5
• Right to a copy of the specific information we hold about you
• Right to deletion, and right to correction of inaccurate information
• Right to limit the use of sensitive personal information: we collect no sensitive categories within the meaning of the CPRA
• Right not to be discriminated against for using any of these rights: we do not offer a different price or a lesser service to anyone who makes a request
• An authorised agent may make a request on your behalf; we will ask for proof of that authorisation
• Requests: info@socialnow.nl. We acknowledge within ten working days and respond within 45 days, with a 45-day extension where needed

17. Making a complaint

If you have a complaint about how we handle your data, e-mail info@socialnow.nl first. We reply within ten working days, with a person, not a form.

If we cannot resolve it together, you can always go to a supervisory authority. In the Netherlands that is the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl). If you live in another EU Member State you may also go to the authority of your own country; it is equally competent. Outside the EU: see section 16.